Everything about your request is completely correct.
If you receive a product list from http://shop.tld/api/product you have used the request type GET instead of POST.
http://shop.tld/api/product
GET
POST
I have double checked it in a local installation.
POST will create your product:
GET will get you a list of all products: